Andrii Bidochko

• Updated: June 12, 2026
• 6 min read

Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification

Direct Answer

The paper introduces STAR (Sentence‑Level Trustworthiness Analysis and Rectification), a defense framework that detects and corrects misleading sentences exchanged among agents in Large Language Model‑based multi‑agent systems (LLM‑MAS). By targeting cooperative attacks—where malicious agents coordinate their misinformation—STAR restores communication integrity and lifts overall task success rates by more than a third.

Background: Why This Problem Is Hard

LLM‑MAS have become the backbone of complex AI workflows, from autonomous planning to collaborative content creation. In these environments, agents continuously share natural‑language messages to align on goals, exchange observations, and negotiate actions. This openness creates a double‑edged sword:

• Semantic richness enables flexible reasoning but also makes it difficult to verify the factual correctness of each utterance.
• Dynamic interaction patterns mean that a single deceptive sentence can cascade through multiple reasoning steps, amplifying its impact.
• Scalability of agent populations forces designers to rely on automated trust mechanisms rather than manual oversight.

Prior defenses assume that malicious agents act in isolation, applying simple filters or reputation scores to whole messages. Those approaches falter when attackers collaborate, synchronizing their falsehoods across rounds to outwit statistical detectors. The problem is further compounded by the lack of fine‑grained trust signals at the sentence level, which is where most reasoning errors originate.

What the Researchers Propose

The authors present a two‑pronged contribution:

1. Adaptive Cooperative Attack Framework: A simulation environment where malicious agents autonomously negotiate attack strategies over multiple interaction rounds. The framework demonstrates how coordinated misinformation can be more damaging than independent attacks.
2. STAR Defense Framework: A modular pipeline that (a) parses each incoming message into individual sentences, (b) evaluates the trustworthiness of each sentence using a lightweight LLM‑based verifier, and (c) rectifies low‑trust sentences by either requesting clarification or substituting a corrected version generated by a trusted model.

Key components of STAR include:

• Sentence Segmentation Engine – isolates atomic statements for independent assessment.
• Trust Scorer – leverages a secondary LLM fine‑tuned on factual verification tasks to assign a confidence score to each sentence.
• Rectification Module – either flags the sentence for human review or automatically rewrites it using a “clean” language model.
• Feedback Loop – updates agent reputations based on the frequency of corrected sentences, discouraging future deception.

How It Works in Practice

The operational flow of STAR can be visualized as a loop that runs every time an agent sends a message:

1. Message Reception: An agent’s outbound message arrives at the central orchestrator.
2. Segmentation: The orchestrator splits the text into discrete sentences.
3. Trust Evaluation: Each sentence is fed to the Trust Scorer, which returns a probability that the statement is factually accurate.
4. Decision Branch:
   • If the score exceeds a predefined threshold, the sentence passes unchanged.
   • If the score falls below the threshold, the Rectification Module intervenes.
5. Rectification: The module either (a) asks the originating agent for clarification or (b) generates a corrected sentence using a vetted LLM.
6. Re‑assembly: All sentences—original or corrected—are recombined into a coherent message and delivered to the target agents.
7. Reputation Update: The originating agent’s trust profile is adjusted based on the proportion of corrected sentences, influencing future message handling.

What sets STAR apart from earlier defenses is its granularity. By operating at the sentence level, the system can preserve the useful parts of a message while neutralizing only the harmful fragments. Moreover, the adaptive feedback loop creates a self‑regulating ecosystem where repeated offenders are progressively isolated.

Evaluation & Results

The researchers benchmarked STAR on two canonical multi‑agent tasks:

• Collaborative Planning: Agents must jointly devise a schedule for a logistics network.
• Complex Question Answering: Agents exchange sub‑answers to resolve a multi‑step query.

For each task, they compared three conditions:

1. Baseline (no attack).
2. Independent attacks (malicious agents act alone).
3. Cooperative attacks (malicious agents coordinate via the Adaptive Cooperative Attack Framework).

Key findings include:

• Cooperative attacks reduced task success rates by an average of 5.34% relative to independent attacks, confirming the heightened risk of coordinated misinformation.
• When STAR was activated, success rates recovered, achieving an average improvement of 36.76% over both attack scenarios.
• The sentence‑level correction introduced less than 0.12 seconds of latency per message, demonstrating practical feasibility for real‑time systems.
• Agent reputation scores converged within ten interaction rounds, indicating rapid adaptation.

These results illustrate that STAR not only mitigates the amplified damage of cooperative attacks but also restores performance to near‑baseline levels without imposing prohibitive computational overhead.

Why This Matters for AI Systems and Agents

For practitioners building enterprise‑grade AI orchestration platforms, the implications are immediate:

• Robustness by Design: Embedding STAR into an Enterprise AI platform by UBOS equips the system with a built‑in safeguard against both opportunistic and coordinated misinformation.
• Compliance and Trust: Industries such as finance, healthcare, and supply chain management demand auditable decision pipelines. Sentence‑level verification provides a transparent audit trail that regulators can inspect.
• Scalable Agent Orchestration: The lightweight nature of the Trust Scorer means that large fleets of agents—potentially thousands—can be monitored without a linear increase in latency, a crucial factor for Workflow automation studio deployments.
• Reduced Human Oversight: By automatically rectifying dubious statements, STAR lowers the burden on human supervisors, allowing teams to focus on higher‑level strategy rather than low‑level fact‑checking.
• Foundation for Future Guardrails: The modular architecture can be extended with domain‑specific verifiers (e.g., legal compliance checkers) or integrated with external knowledge bases, making it a versatile component for any UBOS platform overview implementation.

What Comes Next

While STAR marks a significant step forward, several avenues remain open for exploration:

• Cross‑Modal Trust: Extending verification beyond text to include images, audio, or code snippets could protect multimodal agents that exchange richer data.
• Adversarial Adaptation: Attackers may evolve to craft sentences that evade the Trust Scorer. Continuous adversarial training and ensemble verification could keep defenses ahead.
• Human‑in‑the‑Loop Interfaces: Designing intuitive dashboards for operators to review flagged sentences would blend automated rectification with expert judgment.
• Integration with Existing Tools: Embedding STAR into popular integrations such as the OpenAI ChatGPT integration or the ChatGPT and Telegram integration could democratize access to sentence‑level security across a broader ecosystem.
• Benchmark Standardization: Establishing open benchmarks for cooperative attacks would enable the community to compare defenses on a common footing, fostering rapid iteration.

In summary, the STAR framework offers a pragmatic, high‑impact solution to a growing class of threats in LLM‑driven multi‑agent ecosystems. By dissecting communication to the sentence level, it provides both a shield against coordinated deception and a pathway toward more trustworthy AI collaborations.

For readers interested in the full technical details, the study is available on the original arXiv paper.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.